Authentik OIDC does not work with Helm Chart

[only-a-user]

I tried following this guide for Authentik OIDC integration into Zot, but when I changed the default config.json to this:

{
    "http": {
        "externalUrl": "https://<my-zot-url>",
        "port": "8080",
        "auth": {
            "openid": {
                "providers": {
                    "oidc": {
                        "credentialsFile": "/etc/custom/oidc-credentials.json", //needed to be set to custom, because otherwise the mount would fail
                        "issuer": "https://<my-authentik-url>/application/o/<application_slug>/",
                        "keypath": "",
                        "scopes": ["openid", "profile", "email"]
                    }
                }
            }
        }
    }
}

The stateful set suddenly does not start anymore, with the following indescriptive log:

{"time":"2026-07-12T12:03:04.579851038Z","level":"info","message":"configuration settings","params":{"distSpecVersion":"1.1.1","GoVersion":"go1.26.4","Commit":"v2.1.18-7bb211bcd4352b90f3e99752607fbd1f050bf7ca","ReleaseTag":"v2.1.18","BinaryType":"-events-imagetrust-lint-metrics-mgmt-profile-scrub-search-sync-ui-userprefs","Storage":{"RootDirectory":"/var/lib/registry","MaxRepos":0,"Dedupe":true,"RemoteCache":false,"RedirectBlobURL":false,"GC":true,"Commit":false,"GCDelay":3600000000000,"GCInterval":3600000000000,"Retention":{"DryRun":false,"Delay":3600000000000,"Policies":null},"StorageDriver":null,"CacheDriver":null,"GCMaxSchedulerDelay":0,"SubPaths":null,"FastRestart":null},"HTTP":{"Address":"127.0.0.1","ExternalURL":"https://registry.<my-url>","Port":"5000","AllowOrigin":"","ReadTimeout":60000000000,"WriteTimeout":60000000000,"TLS":null,"Auth":{"FailDelay":0,"HTPasswd":{"Path":""},"LDAP":null,"Bearer":null,"OpenID":{"Providers":{"oidc":{"CredentialsFile":"","Name":"","ClientID":"******","ClientSecret":"******","KeyPath":"","Issuer":"https://auth.<my-url>/application/o/zot/","AuthURL":"","TokenURL":"","Scopes":["openid","profile","email"],"ClaimMapping":null}},"CallbackAllowOrigins":null},"APIKey":true,"SessionKeysFile":"","SessionDriver":null},"AccessControl":null,"Realm":"","Ratelimit":null,"Compat":null},"Log":{"Level":"info","Output":"","Audit":""},"Extensions":null,"scheduler":null,"cluster":null},"caller":"zotregistry.dev/zot/v2/pkg/api/controller.go:332","func":"zotregistry.dev/zot/v2/pkg/api.(*Controller).Init","goroutine":1}
{"time":"2026-07-12T12:03:04.580010101Z","level":"info","message":"jwt bearer authentication","enabled":false,"caller":"zotregistry.dev/zot/v2/pkg/api/controller.go:336","func":"zotregistry.dev/zot/v2/pkg/api.(*Controller).Init","goroutine":1}
{"time":"2026-07-12T12:03:04.580043423Z","level":"info","message":"oidc bearer authentication","enabled":false,"caller":"zotregistry.dev/zot/v2/pkg/api/controller.go:337","func":"zotregistry.dev/zot/v2/pkg/api.(*Controller).Init","goroutine":1}
{"time":"2026-07-12T12:03:04.580069072Z","level":"info","message":"basic authentication (htpasswd)","enabled":false,"caller":"zotregistry.dev/zot/v2/pkg/api/controller.go:338","func":"zotregistry.dev/zot/v2/pkg/api.(*Controller).Init","goroutine":1}
{"time":"2026-07-12T12:03:04.580094099Z","level":"info","message":"basic authentication (LDAP)","enabled":false,"caller":"zotregistry.dev/zot/v2/pkg/api/controller.go:339","func":"zotregistry.dev/zot/v2/pkg/api.(*Controller).Init","goroutine":1}
{"time":"2026-07-12T12:03:04.580123796Z","level":"info","message":"basic authentication (API key)","enabled":true,"caller":"zotregistry.dev/zot/v2/pkg/api/controller.go:340","func":"zotregistry.dev/zot/v2/pkg/api.(*Controller).Init","goroutine":1}
{"time":"2026-07-12T12:03:04.580151508Z","level":"info","message":"OpenID authentication","enabled":true,"caller":"zotregistry.dev/zot/v2/pkg/api/controller.go:341","func":"zotregistry.dev/zot/v2/pkg/api.(*Controller).Init","goroutine":1}
{"time":"2026-07-12T12:03:04.580177607Z","level":"info","message":"mutual TLS authentication","enabled":false,"caller":"zotregistry.dev/zot/v2/pkg/api/controller.go:342","func":"zotregistry.dev/zot/v2/pkg/api.(*Controller).Init","goroutine":1}
{"time":"2026-07-12T12:03:04.580316581Z","level":"info","message":"runtime params","cpus":4,"max. open files":1048576,"listen backlog":"4096","max. inotify watches":"47081","caller":"zotregistry.dev/zot/v2/pkg/api/runtime.go:18","func":"zotregistry.dev/zot/v2/pkg/api.DumpRuntimeParams","goroutine":1}
{"time":"2026-07-12T12:03:04.580382586Z","level":"info","message":"events disabled in configuration","caller":"zotregistry.dev/zot/v2/pkg/extensions/extension_events.go:17","func":"zotregistry.dev/zot/v2/pkg/extensions.NewEventRecorder","goroutine":1}
{"time":"2026-07-12T12:03:04.585548Z","level":"info","message":"parsing storage and initializing","component":"metadb","caller":"zotregistry.dev/zot/v2/pkg/meta/parse.go:50","func":"zotregistry.dev/zot/v2/pkg/meta.parseStorage","goroutine":1}
{"time":"2026-07-12T12:03:04.58575902Z","level":"info","message":"successfully initialized","component":"metadb","caller":"zotregistry.dev/zot/v2/pkg/meta/parse.go:116","func":"zotregistry.dev/zot/v2/pkg/meta.parseStorage","goroutine":1}
{"time":"2026-07-12T12:03:04.5872784Z","level":"warn","message":"hashKey is not set in config, generating a random one","caller":"zotregistry.dev/zot/v2/pkg/api/controller.go:403","func":"zotregistry.dev/zot/v2/pkg/api.(*Controller).initCookieStore","goroutine":1}
{"time":"2026-07-12T12:03:04.587521431Z","level":"info","message":"cve config not provided, skipping cve-db update","caller":"zotregistry.dev/zot/v2/pkg/extensions/extension_search.go:58","func":"zotregistry.dev/zot/v2/pkg/extensions.EnableSearchExtension","goroutine":1}
{"time":"2026-07-12T12:03:04.587569081Z","level":"info","message":"metrics config not provided, skipping metrics config update","caller":"zotregistry.dev/zot/v2/pkg/extensions/extension_metrics.go:20","func":"zotregistry.dev/zot/v2/pkg/extensions.EnableMetricsExtension","goroutine":1}
{"time":"2026-07-12T12:03:04.587595512Z","level":"info","message":"scrub config not provided, skipping scrub","caller":"zotregistry.dev/zot/v2/pkg/extensions/extension_scrub.go:49","func":"zotregistry.dev/zot/v2/pkg/extensions.EnableScrubExtension","goroutine":1}
{"time":"2026-07-12T12:03:04.587623204Z","level":"info","message":"sync config not provided or disabled, so not enabling sync","caller":"zotregistry.dev/zot/v2/pkg/extensions/extension_sync.go:84","func":"zotregistry.dev/zot/v2/pkg/extensions.EnableSyncExtension","goroutine":1}
{"time":"2026-07-12T12:03:04.73851645Z","level":"info","message":"no repositories found in storage, finished.","component":"dedupe","caller":"zotregistry.dev/zot/v2/pkg/storage/common/common.go:1010","func":"zotregistry.dev/zot/v2/pkg/storage/common.(*DedupeTaskGenerator).Next","goroutine":67}
{"time":"2026-07-12T12:03:05.559479779Z","level":"warn","message":"skipping enabling swagger because given zot binary doesn't include this feature, please build a binary that does so","caller":"zotregistry.dev/zot/v2/pkg/debug/swagger/swagger_disabled.go:19","func":"zotregistry.dev/zot/v2/pkg/debug/swagger.SetupSwaggerRoutes","goroutine":1}
{"time":"2026-07-12T12:03:05.559557778Z","level":"warn","message":"skipping enabling graphql playground extension because given zot binary doesn't include this feature, please build a binary that does so","caller":"zotregistry.dev/zot/v2/pkg/debug/gqlplayground/gqlplayground_disabled.go:16","func":"zotregistry.dev/zot/v2/pkg/debug/gqlplayground.SetupGQLPlaygroundRoutes","goroutine":1}
{"time":"2026-07-12T12:03:05.559610878Z","level":"info","message":"setting up metrics routes","caller":"zotregistry.dev/zot/v2/pkg/extensions/extension_metrics.go:27","func":"zotregistry.dev/zot/v2/pkg/extensions.SetupMetricsRoutes","goroutine":1}
{"time":"2026-07-12T12:03:05.55964351Z","level":"info","message":"skip enabling the search route as the config prerequisites are not met","caller":"zotregistry.dev/zot/v2/pkg/extensions/extension_search.go:83","func":"zotregistry.dev/zot/v2/pkg/extensions.SetupSearchRoutes","goroutine":1}
{"time":"2026-07-12T12:03:05.559681472Z","level":"info","message":"skip enabling the image trust routes as the config prerequisites are not met","caller":"zotregistry.dev/zot/v2/pkg/extensions/extension_image_trust.go:32","func":"zotregistry.dev/zot/v2/pkg/extensions.SetupImageTrustRoutes","goroutine":1}
{"time":"2026-07-12T12:03:05.5597122Z","level":"info","message":"skip enabling the mgmt route as the config prerequisites are not met","caller":"zotregistry.dev/zot/v2/pkg/extensions/extension_mgmt.go:89","func":"zotregistry.dev/zot/v2/pkg/extensions.SetupMgmtRoutes","goroutine":1}
{"time":"2026-07-12T12:03:05.559741607Z","level":"info","message":"skip enabling the user preferences route as the config prerequisites are not met","caller":"zotregistry.dev/zot/v2/pkg/extensions/extension_userprefs.go:33","func":"zotregistry.dev/zot/v2/pkg/extensions.SetupUserPreferencesRoutes","goroutine":1}
{"time":"2026-07-12T12:03:05.559772073Z","level":"info","message":"skip enabling the ui route as the config prerequisites are not met","caller":"zotregistry.dev/zot/v2/pkg/extensions/extension_ui.go:67","func":"zotregistry.dev/zot/v2/pkg/extensions.SetupUIRoutes","goroutine":1}
{"time":"2026-07-12T12:03:34.0253179Z","level":"info","message":"received signal","signal":15,"caller":"zotregistry.dev/zot/v2/pkg/cli/server/config_reloader.go:45","func":"zotregistry.dev/zot/v2/pkg/cli/server.signalHandler","goroutine":42}
{"time":"2026-07-12T12:03:34.037657226Z","level":"error","message":"failed to start controller, exiting","error":"http: Server closed","caller":"zotregistry.dev/zot/v2/pkg/cli/server/root.go:99","func":"zotregistry.dev/zot/v2/pkg/cli/server.newServeCmd.func1","goroutine":1}
stream closed: EOF for zot-registry/zot-0 (zot)

Does anyone know how this happens and how to fix it?

[andaaron]

Hi @only-a-user, this doesn't seem to be Authentik OIDC related. Seems like the startup probe fails after ~30 seconds.
Can you double check your ports used (the provided config mentions port 8080, and the logs mention 5000, the logs couldn't have been from this config). Can you also check the listening address 127.0.0.1 in the logs makes sense?